Iranian Hackers Deploy CHOSEN BRICK Malware to Spy on Dissidents Worldwide

Government cyber units across Europe and North America have raised alarms as Iranian state‑linked actors unleash the CHOSEN BRICK malware, a Windows‑based espionage tool aimed at dissidents, activists and journalists.

CHOSEN BRICK Malware Targets Activists and Journalists

The code, first observed in late 2023, embeds a remote access module that can exfiltrate documents, intercept communications and activate the camera without user consent. Security firms report that the payload spreads through compromised email attachments and fake software updates, often masquerading as legitimate open‑source utilities. Victims have described sudden system slowdowns and unexplained network traffic. A senior analyst at Reuters warned that the campaign “reflects a growing willingness of Tehran to weaponize civilian infrastructure against perceived enemies.”

“The sophistication rivals commercial spyware, yet the attribution to Iranian actors is increasingly certain,” the analyst added.

Recent scans indicate a ↓ 27% drop in detection rates, suggesting that existing antivirus signatures lag behind the evolving code. AP News notes that the malware’s command‑and‑control servers are hosted in jurisdictions with limited extradition treaties, complicating takedown efforts. The threat underscores the broader trend of state‑sponsored cyber operations that surged during the pandemic and have not receded. Authorities advise immediate patching of Windows systems and heightened scrutiny of unsolicited attachments.

Words by Leo Carmichael (Special Assignments Reporter).
(Note: Leo Carmichael is covering this desk while Kaelen Frost is on annual vacation.)